Overview
On 10 May 2022 and as part of the Queen’s speech, which sets out the programme of legislation for the forthcoming parliamentary session, the government announced proposals to table a Data Reform Bill (the Bill) to reform the UK’s data protection regime and to diverge from European GDPR1. This follows the consultation by the Department for Digital, Culture, Media and Sport (DCMS) consultation released last September.
In Depth
The UK government has stated that the purpose of the Bill is to reduce red tape and encourage innovation, modernise the Information Commissioner’s Office, and improve appropriate access to data in health and social care contexts by designing a more flexible approach, focused on privacy outcomes rather than box-ticking exercises.
The Government proposes to2:
- Remove some obligations, such as to:
- appoint a data protection officer;
- conduct data protection impact assessments;
- consult with the Information Commissioner in relation to high-risk processing; and
- prepare records of processing activities.
- Allow broader use of data for research and AI projects, or consolidating the research provisions in the UK GDPR and Data Protection Act 2018 to provide more clarity. [Please note that the ICO have recently issued a draft guidance on the processing for research purposes. More information on this can be found here];
- Change the law to enable public authorities to share personal data for specific purposes, such as public health purposes; and
- Reform the Information Commissioner’s Office to enhance its enforcement powers but also to make it more accountable to the Parliament and public.
The DCMS analysis indicates that the proposed reforms will create over £1 billion in business savings over ten years by reducing burdens on businesses of all sizes3. Despite the revolutionary tone of these announcements, the UK will still likely wish to ensure that the reform does not lessen the protection of personal data and thus does not impact the EU adequacy decision, which enables the free transfer of personal data from the EU to the UK.
It may take some time before the Bill is tabled. At the same time, there seem to be some parallels on approach on the European front. On 3 May, the European Commission launched the European Health Data Space (EHDS) which aims to foster a single market for digital health services and products. Part of the EHDS strategy is improving the use of health data for research, innovation and policymaking4.
